Secure Location Verification with Hidden and

Mobile Base Stations

Srdjan

Capkun, Member, IEEE, Kasper Bonne Rasmussen, Member, IEEE,
Mario

Cagalj, Member, IEEE, and Mani Srivastava, Member, IEEE
AbstractIn this work, we propose and analyze a new approach for securing localization and location verification in wireless networks
based on hidden and mobile base stations. Our approach enables secure localization with a broad spectrum of localization techniques,
ultrasonic or radio, based on the received signal strength or signal time of flight. Through several examples, we show how this
approach can be used to secure node-centric and infrastructure-centric localization schemes. We further show how this approach can
be applied to secure localization in mobile ad hoc and sensor networks.
Index TermsMobility, location verification, security, wireless networks.

1 INTRODUCTION
I
Nthe last decade, researchers have proposed a number of
localization and ranging techniques for wireless net-
works [50], [51], [35], [4], [20], [10]. The use of these
techniques is broad and ranges from enabling networking
functions (that is, position-based routing) to enabling
location-related applications (for example, access control
and data harvesting).
The proposed techniques were mainly studied in non-
adversarial settings. Ranging and localization techniques
are, however, highly vulnerable to attacks from dishonest
nodes and external attackers: dishonest nodes can report
false position and distance information in order to cheat on
their locations, whereas external attackers can spoof mea-
sured locations of honest nodes. Localization and ranging
techniques in wireless networks mainly rely on measure-
ments of the time of flight of radio (RF ToF) or time of flight
of ultrasound signals (US ToF) and on the measurements of
received strengths of radio signals of devices (RF RSS). An
attacker can generally influence all these measurements by
jamming and delaying signals and by modifying their signal
strengths. Localization systems based on US ToF and those
based on the measurements of RF RSS are particularly
vulnerable to position spoofing attacks. Systems based on
RF ToF measurements are less vulnerable to attacks because
of the high speed of signal propagation.
Recently, a number of secure localization techniques
have been proposed [25], [26], [48], [28], [29] to cope with
these problems. These mechanisms rely on GPS, high-speed
hardware, directional antennas, robust statistics, or spread
spectrum techniques using spreading codes. An efficient
implementation of these protocols remains a challenge,
however, since almost all of them rely on ToA ranging and
generally assume fast processing hardware with ns preci-
sion at the prover (except in the case of ultrasound
implementations, which are limited in range). Our proposal
works with simple ranging (not with distance bounding)
and therefore does not require fast processing at the prover
(claimant). Our proposal works equally well by using any
kind of ranging, even low-cost RSSI-based methods (for
example, [4], [20], and [10]).
Our approach to secure localization relies on a set of
covert base stations (CBSs). By CBS, we mean base stations
whose locations are not known by the attacker at the time of
the execution of the secure localization. In our system, the
locations of CBSs represent a secret input (a key) to the
system. CBSs can be realized by hiding or disguising a static
base station or by the random motion of mobile base
stations (MBSs). Typically, CBSs are passive.
The aim of the protocols in this paper is to ensure that a
node cannot lie about its position and thus pretend to be in
a different physical location than the one that it occupies.
For example, a node cannot (successfully) claim to be in a
room if the node is outside that room (for example, for
location-based access control).
We show through three example protocols how CBSs can
be used to secure node-centric and infrastructure-centric
localization, as well as for localization and location
verification in ad hoc and sensor networks. We discuss
how the security of the proposed protocols depends on the
precision of the localization and ranging techniques and on
the number of CBSs. We capture this analytically.
The organization of the rest of this paper is given as
follows: In Section 2, we present our system model. In
Sections 3 and 4, we present protocols for secure localization
in infrastructure-centric and node-centric systems, respec-
tively. In Sections 5 and6, we showhowMBSs can be applied
to secure localization in sensor and mobile ad hoc networks.
470 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 4, APRIL 2008
. S.

Capkun and K.B. Rasmussen are with the Department of Computer
Science, ETH Zurich, 8092 Zurich, Switzerland.
E-mail: {capkuns, kasperr}@inf.ethz.ch.
. M.

Cagalj is with the Department of Electronics, Faculty of Electrical
Engineering, Mechanical Engineering, and Naval Architecture (FESB),
University of Split, 21000 Split, Croatia. E-mail: mario.cagalj@fesb.hr.
. M. Srivastava is with the Electrical Engineering Department, University
of California, Los Angeles, Los Angeles, CA 90095. E-mail: mbs@ucla.edu.
Manuscript received 23 Jan. 2007; revised 23 July 2007; accepted 16 Oct.
2007; published online 6 Nov. 2007.
For information on obtaining reprints of this article, please send e-mail to:
tmc@computer.org, and reference IEEECS Log Number TMC-0029-0107.
Digital Object Identifier no. 10.1109/TMC.2007.70782.
1536-1233/08/$25.00 2008 IEEE Published by the IEEE CS, CASS, ComSoc, IES, & SPS
In Section 7, we analyze our schemes. In Section 8, we review
the related work. We conclude this paper in Section 9.
2 MODEL
In this section, we describe our system and attacker models.
2.1 System Model
Our system consists of a set of CBSs and a set of public base
stations (PBS) forming a localization infrastructure. Here, by
CBSs, wemeanthosebasestations whoselocations areknown
only to the authority controlling the verification infrastruc-
ture. To prevent their locations from being discovered
through radio signal analysis, CBSs are silent on the wireless
channel: they only listen to the ongoing communication.
In our system, CBSs and PBSs know their locations or can
obtain their locations securely and passively (for example,
through a secure GPS [25]). Here, we assume that the
attackers cannot tamper with these locations or compromise
the base stations.
We also assume that every legitimate node shares a secret
key with the base stations or that base stations hold an
authentic public key of the node. This key is established/
obtained through the authority controlling the verification
infrastructure prior to position verification. Here, all com-
munication between the authority and a node is performed
through a PBS, whereas the hidden stations remain passive.
We further assume that CBSs can measure the received
signal strength or have an ultrasonic interface, through
which they perform ranging.
In most of this work, we assume that CBSs are static. Thus,
their mutual communication and their communication to the
verification authority is performed through a channel that
preserves their location privacy. This communication chan-
nel is typically wired (or infrared) such that they cannot be
detected by the attackers. In Section 5, we modify our
assumptions. We replace the PBSs and CBSs with MBSs, and
we assume that their mutual communication is wireless.
Finally, we assume that the nodes (legitimate or
otherwise) have a limited number of attempts to prove
their location to the infrastructure. This is needed in order
to prevent the nodes from simply trying different distances
until they get it right.
2.2 Attacker Model
We observe two types of attacks: internal and external.
Internal attacks are those in which a dishonest or compro-
mised node (internal attacker) reports a false position or
convinces the localization infrastructure that it is at a false
position. External attacks are those in which an external
attacker convinces an honest node and the localization
infrastructure that the node is at a different position from its
true position (that is, the attacker spoofs a nodes position).
We observe two types of localization systems: node
centric and infrastructure centric. By a node-centric locali-
zation system, we mean that a node computes its position
by observing the signals received from PBSs with known
locations. If the localization system is node centric, internal
attacks are generally straightforward: an attacker simply
lies about the position that it computed. Infrastructure-centric
localization systems are those in which the infrastructure
computes the locations of nodes based on their mutual
communication. In multilateration-based approaches, an
internal attacker can cheat on its position by cheating on
ranging mechanisms (that is, by reporting false signal
strengths and times of signal sending/reception). In time
difference of arrival (TDOA) systems, an attacker can cheat
by sending signals to base stations at different times (for
example, by using directional antennas).
Attacks by external attackers are similar to those
performed by internal attackers. An external attacker can
perform timing attacks by delaying the signal (through
jamming) or speeding it up (through wormhole attacks [22],
[45]). The attacker can also perform power-level modifica-
tion attacks by replaying signals at different power levels.
3 INFRASTRUCTURE-CENTRIC LOCALIZATION WITH
HIDDEN BASE STATIONS
In this section, we describe a simple solution for securing
infrastructure-centric localization systems based on TDOA
and CBSs.
TDOA is the process of localizing the source of a signal
in two (respectively, three) dimensions by finding the
intersection of multiple hyperbola based on the TDOA
between the signal reception at multiple base stations.
Using two hyperboles (three base stations), we can obtain
2Ddevice locations, and using three hyperboloids (four base
stations), we can determine 3D locations. The operation of
the TDOAtechnique is shown in Fig. 1. Node sends a radio
signal, and the verifiers C1o

, C1o
1
, and C1o
C
measure
the difference between the signal arrival time and determine
the position of .
One of the main advantages of TDOA is that node
localization does not require communication from the base
stations to the mobile nodes: the base stations locate mobile
nodes by measuring the signal reception times at each base
station. This is why TDOA is well suited for secure
localization with hidden base stations.
In our protocol, the base stations are hidden and only
listen to the beacons sent by the nodes. Upon receiving the
beacons, the base stations compute the nodes location with
TDOA and check if this location is consistent with the time
differences. By consistent, we mean that the computed
position is not too far from the intersection point of the

CAPKUN ET AL.: SECURE LOCATION VERIFICATION WITH HIDDEN AND MOBILE BASE STATIONS 471
Fig. 1. An example of localization with TDOA. The base stations C1o

,
C1o
1
, and C1o
C
measure the differences of signal arrival times and
computes the position of the attacker. The full lines are the hyperboles
found by each pair of base stations.
hyperboles constructed with measured time differences
(see Fig. 1). TDOA with hidden base stations is designed to
detect both internal and external attacks and relies on the
assumption that the attackers can guess the locations of base
stations only with a very low probability. The protocol is
executed as shown in Fig. 2.
3.1 Security Analysis
Here, j is a position of node computed from the
measured time differences, and it is the solution to the
following least square problem:
j arg min
j

X
i,
jt
i
i
t
,
i
j /j

. i. ,
2
.
where /j

. i. , is the expected difference of signal

reception times at C1o
i
and C1o
,
(based on the known
signal propagation time) if the signal is sent from
position j

, and jt
i
i
t
,
i
j is the measured difference at
C1o
i
and C1o
,
. is the maximal expected inconsistency
between the computed position and the measured time
differences. This inconsistency is caused by the errors in
measurements of reception times and by pairwise clock
drifts of the base stations. T is the time within which a node
needs to reply to a challenge issued by a PBS: this response
time is important for the prevention of some replay attacks
and to ensure message freshness. ` is a fresh nonce. Note
that the CBSs know which nonce is sent by the public
station. Conventional TDOA schemes are vulnerable to both
internal and external attacks. An internal attacker can
send messages to base stations, with appropriate delays
(potentially using directional antennas), and thus cheat on
its location, whereas an external attacker can jam and delay
a nodes original messages and thus spoof its location.
With CBSs, these attacks are prevented: to successfully
cheat, the attackers need to know where the base stations are
located. Otherwise, the attacker needs to guess the locations
of the base stations and perform appropriate timing attacks.
The attackers cheating success depends on the system
precision . Essentially, defines the size of the attackers
guessing space. To put it simply, if is large, a false position
will be more likely accepted, as the tolerance to incon-
sistencies will be higher. In Section 7, we investigate in more
detail the relationship between and the attackers success.
In addition, we need to consider one more external attack
on TDOA, that is, an external wormhole. This attack is
performed as follows: 1) an attacker jams the original
localization message i sent by node and 2) the attacker
replays ifroma locationj
0

. As a result, the base stations will

be convinced that node is located at j
0

, whereas its true

positionis j

. Inorder tomount this attack, the attacker needs

to jam all hidden base stations and have faster processing
than regular mobile nodes. Finally, in order to show that
node is at j
0

, the attacker needs to have access to this

location. Still, this attack is feasible for a resourceful attacker.
Using CBSs, this attack is partially prevented by the
challenge-response scheme. In our protocol, the node is
expected to reply to a challenge nonce ` within a period T,
which limits the time during which the attacker can mount
the attack. Here, T is estimated based on the expected signal
propagation times and node processing time. We note that
this simple challenge-response scheme couldbe replacedbya
more efficient distance-bounding protocol [6], [46], in which
case this and similar attacks can be completely prevented. In
some implementations, this will require some specialized
hardware at the side of nodes and base stations. The same
attacks can also be prevented through precise time synchro-
nization. However, if the base stations and the devices can
perform (expensive) distance-bounding protocols, other
(distance-bounding-based) approaches like Verifiable Multi-
lateration [48] can be used for the verification of devices
locationclaims. The proposedTDOA-basedlocationverifica-
tion scheme (without distance bounding) is therefore a low-
cost alternative for location verification in scenarios in which
false location claims do not benefit the attacker and/or those
scenarios in which the attacker does not have the ability to
perform the described wormhole attack (that is, either it
cannot jam the communication between the node and the
base station or it does not have fast-processing hardware).
In our protocol, node location privacy is not preserved.
However, this protocol can be enhanced to include PBS
authentication, which prevents an attacker from challenging
the node and from prompting it to send localization signals,
disclosing its location. Other attacks are possible on a
nodes location privacy [38], [19], [39], [42], [23], [24], but
coping with these attacks is out of the scope of this paper.
4 NODE-CENTRIC LOCALIZATION WITH HIDDEN
BASE STATIONS
In this section, we present a protocol for secure localization
in node-centric localization systems. Here, we assume that
the node computed its position through a nonsecure
localization system. This position is then reported to the
infrastructure comprised of CBSs, which then verifies if the
position is correct. In this context, internal attacks are
related to nodes lying about their locations, whereas
external attacks are more complex and assume that the
attacker spoofs the nodes position and then cheats on the
position verification mechanisms.
Tocopewiththeseattacks, weproposeapositionverification
protocol that relies on hidden base stations. In this protocol,
node reports a positionj
1
to a CBS. The CBS then measures
its distance d
i
1
to the node (passively) and verifies if the
reported position j
1
corresponds to the measured distance.
Our protocol is shown in Fig. 3. Here, ` is a nonce
generated by the PBS, is a combined localization and
472 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 4, APRIL 2008
Fig. 2. TDOA with hidden base stations.
ranging error, and T is the time within which a node needs
to reply to a challenge issued by a PBS.
In this protocol, the infrastructure uses a PBS to
communicate with the node and a single CBS to verify the
reported position. The PBS sends a challenge to the node ,
which then replies by sending radio and ultrasonic
messages containing the alleged node position j
1
. The
CBS then measures the time difference between the time at
which it received the radio signal t
i1
and the time at which it
received the ultrasound signal t
n:
and computes the distance
d
c
1
dj
1
. j
C1o
to . If the reported (possibly fake) position
corresponds to the measured (possibly fake) distance, the
CBS concludes that j
1
is the position of . An illustration
of a fake position report is shown in Fig. 4. To do this, the
CBS simply computes the distance d
c
1
dj
1
. j
C1o
between
its own position j
C1o
(which is unknown to the node)
and the reported position j
1
and compares it with the
measured distance d
i
1
(which can enlarge or reduce). If the
two distances differ by more than the expected combined
localization and ranging error , then the position is
rejected; else, the position is accepted as the true node
position. An additional verification is made by measuring
the node response time T in order to prevent replay attacks.
We note that this protocol could be similarly designed
with RF-RSS-based ranging techniques or with any other
passive ranging technique available, including passive
RF ranging.
4.1 Security Analysis
An internal attack in node-centric localization schemes is
simply a false position report from the node to the
infrastructure. Our protocol detects false position reports
through checking the consistency of the reported position
and of the measured distance. This detection mechanism
relies on the fact that the attacker can guess the distance of
j
1
to the hidden base station only with a low probability.
We analyze this in detail in Section 7.
External attacks against position verification are more
complex and include position spoofing, jamming, and
message replays. Fig. 5 shows an external attack on position
verification. Node is positioned at j

, the attacker at
position j
1
. The attacker first spoofs the position of such
that believes that it is positioned at j
1
. Then, by replaying
s localization signals (radio and ultrasound) from j
1
, the
attacker fools the position verification mechanism. This
attack enables the attacker to convince the device that it
is positioned at j
1
and then convinces the CBS that is
at j
1
. One limitation of this attack is that an attacker needs
to have a device at the position where it wants to falsely
place and that the attacker nodes need to be tightly
synchronized to perform it.
Our position verification protocol partially prevents this
attack by the same technique used in the TDOA protocol
with hidden base stations: the base stations require that the
node replies with the RF message to the PBS challenge
within a time bound T. This limits the time within which
the attacker can mount the attack. With distance-bounding
techniques [6], this attack can be entirely prevented, as the
value of T can be reduced to nanoseconds.
Similar to our TDOA-based protocol, the position
verification protocol is also vulnerable to location privacy
threats. Here, the most obvious privacy problem is that the
node discloses its position to any station that issues a
position verification request (step 2 of the protocol). An
attacker can simply listen to the nodes messages and learn
where the node is located. Similarly, an attacker could send
a position verification request to the node to keep track of
the nodes position. This attack can be prevented by simply
requiring a PBS to authenticate itself to the node and by
having a node encrypt the position information that it sends
to the base stations.

CAPKUN ET AL.: SECURE LOCATION VERIFICATION WITH HIDDEN AND MOBILE BASE STATIONS 473
Fig. 3. Position verification with hidden base stations.
Fig. 4. False position report by node to the CBS. j

is the true node

position, j
1
is the fake node position (reported by to the CBS), and
j
C1o
is the position of the CBS. d
c
1
dj
1
. j
C1o
is the (false) distance
between the CBS and computed by the CBS, and d
i
1
is the (false)
distance between and the CBS measured passively by the CBS.
If jd
c
1
d
i
1
j , then j

j
1
.
Fig. 5. Position spoofing attack. (a) The attacker spoofs node into
believing that it is at the attackers location 1
1
(for example, by using a
fake GPS station). (b) Then, the attacker jams the localization message
and replays it from its own position there by fooling the CBS into
accepting the position as real (that is, the distance will match).
A cloning attack is an attack in which the attacker
successfully compromises a node to such a degree that
private keys and other secret node-specific information can
be copied. The attacker cannowdeploy any number of copies
of the original node throughout the network. Our protocols
make no attempt to detect cloning attacks; however,
fingerprinting [36] could be used as a way of distinguishing
the copies from the original. It should be noted that a
cloning attack does not constitute a breach of security in,
for example, an access control application, since the attacker
still needs to place a clone within the access-controlled area.
Finally, the attacker can interfere with the communication
of legitimate nodes to change the time of flight of a signal,
thereby making it seem as if the nodes are reporting false
positions. Some applications might want to exclude nodes
after a certain number of false positions have been received,
and in such a case, this attack could be very damaging.
However, this is entirely application and policy specific.
Excluding a node after a number of false positions have been
received is straightforward, as the protocol requires the node
to send signed messages. Although an attacker might
succeed in performing a denial-of-service attack and thus
introduce more false positives, the attacker can only create a
false negative with a very small probability (see Section 7).
5 SECURE LOCALIZATION IN SENSOR NETWORKS
WITH MOBILE BASE STATIONS
The use of MBSs has already been proposed for data
collection, energy preservation, localization, and security in
wireless networks [41], [49], [21]. Many mobile platforms
have emerged as a result: Amigobot [1], Cotsbot [5],
Millibot [31], Robomote [12], and Ragobot [17].
In this section, we describe the use of MBSs for secure
localization in sensor networks.
5.1 Scenario
In our scenario, we rely on MBSs. We show how MBSs can
be used to secure localization and to verify the locations of
sensor nodes.
We assume that the sensors compute their locations
through one of the nonsecure localization algorithms [13],
[7], [47], [33], [32], [44], [30], [14], [11].
We further assume that the authority has a number of
MBSs (similar to data mules) that know securely their
locations (for example, through a secure GPS [25]). These
MBSs can be single purpose or multipurpose and therefore
can be used not only for position verification but also for
data collection and other tasks.
We assume that the MBSs share a secret key with each
sensor.
5.2 Position Verification with Mobile Base Stations
The protocol presented in this section is similar to the
position verification protocol presented in Section 4. That
protocol relied on the assumption that the CBS is hidden,
whereas all communication between the node and the
localization infrastructure is performed through the PBS.
Here, position verification is performed through MBSs.
This is realized such that the base station sends a
verification request to the node from one location and then
waits for the response at a different location. Therefore, at
the time of position verification, the node does not know the
position of the MBS. In this protocol, the role of a PBS is
thus replaced with base station mobility.
Our protocol is shown in Fig. 6. Here, 1 is the secret key
shared between the mobile station `1o and the sensor .
After receiving a localization message from the `1o, is
supposed to send a response for the next T
1
sec. In order to
avoid interference from other nodes who also received the
same localization message, a suitable MAC protocol must
be used to ensure that everyone has access to the channel.
T
1
is also the time within which `1o must move to a new
location and receive the response from all the nodes that are
still in range.
T
1
must not give away any information about the
distance from the current transmission position to the next
verification position. Furthermore, T
1
must allow enough
time for the `1o to wait a few seconds at its new location
until all the nodes have replied.
The operation of our protocol is illustrated in Fig. 7. At
time t
1
, an MBS is at position j
`1o
t
1
and sends a message
to the neighboring sensors containing a challenge nonce `
and a time delay T
1
after which the sensors needs to reply
to the message. Within the time T
1
, the MBS moves to a
different position j
`1o
t
2
within the circle defined by its
power range when it was at position j
`1o
t
1
. When at
position j
`1o
t
2
, the MBS receives a reply from the sensors
that are still in its power range. Based on the received
replies, the MBS computes the distances to the sensors and
verifies their locations (this procedure is the same as in the
position verification protocol presented in Section 4).
474 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 4, APRIL 2008
Fig. 6. Position verification with MBSs.
Fig. 7. Position verification in sensor networks. An MBS verifies the
locations of nodes. (a) At time t
1
, the MBS challenges sensor nodes.
(b) At time t
2
t
1
, the sensors reply to the challenge, and their locations
are verified by MBS.
5.3 Mobile Base Station Coverage and Simulation
Typically, the MBS can perform simultaneous verification of
locations of multiple sensors. If at each motion step t
i
, the
MBS moves within the circle defined by its power range, it
will hear at least 39 percent of the sensors that were in its
power range at time t
i1
, provided that the sensors are
uniformly distributed over the MBSs power range.
1
This is
because the intersection of the MBSs power ranges at t
1
and at t
2
will be at least 39 percent of the circle surface, given
that the MBS moved within its previous power range.
At time t
1
, the MBS broadcast a challenge to the nodes, and
at time t
2
, the nodes replied. After position verification,
the MBS issues another challenge for the nodes in its power
range, whose locations were not verified, and then, the
MBS moves again and waits for their replies. Hence, as
the MBS moves through the network, it will only verify
locations of the sensors that were in the intersections of
two subsequent power ranges of the MBS. This is illustrated
in Fig. 8. The trajectory of the MBS needs to be unpredictable
for the sensor nodes, even if the sensors collude. One way of
ensuring this is to have the MBSs move according to a
random walk. Given this, if the sensors are placed on a grid,
the time in which the MBS covers the network can be
estimated as O` log `, where ` is the number of sensors.
In [41] and [3], the authors provide a set of analytical and
simulation results for the coverage times of mobile stations
on sensor grids.
If the sensors are randomly distributed, the coverage
time will depend on the radio range and on the movement
range of the MBS (and speed of course). Fig. 9 is a plot of the
coverage as a function of the movement range. A single
MBS moves according to a random walk for 60 seconds in a
500 m 500 m area with 300 nodes. The four different
curves are four different transmission ranges. It is clear in
the figure that the best results are achieved if the movement
range and the transmission range are equal (or very
similar). This is because if the movement range is smaller
than the transmission range, the MBS does not take full
advantage of the size by not moving far enough, and if the
movement range is larger than the transmission range, the
MBS will move too far away to receive the replays from all
the nodes. Of course, the coverage improves when the
transmission/movement range is increased.
Fig. 10 shows the coverage time of 300 sensors placed
randomly throughout an area of 500 m500 m. One node is
chosen to be an MBS and moves through the network by
using random walk. At each position, the MBS listens for the
reply to previous challenges, issues a new challenge, picks a
new point on the disk described by its transmission range,
and moves there. The speed at which the MBS moves is set
to 50 m/s, which is about the speed of a small drone over a
battlefield, and the node time-out T
1
is set to 5 seconds.
As expected, the performance increases with the
transmission/movement range, as more nodes are localized
in each step. A function of the form
C ot / lnt c 1
can be fitted to each of the three data plots, where C is the
relative coverage, and t is the time. The parameters o, /,
and c are determined by the size of the area, the speed of the
MBS, and the transmission/movement range. Using (1), it is
possible to estimate the required equipment specifications

CAPKUN ET AL.: SECURE LOCATION VERIFICATION WITH HIDDEN AND MOBILE BASE STATIONS 475
1. This also assumes that either the `1o and the nodes have the same
transmission radius or the `1o has a high-gain antenna that will enable it
to receive the reply from within its own transmission radius.
Fig. 8. Progress of position verification in sensor networks with MBSs.
An MBS moves from position j
`1o
t
1
to j
`1o
t
2
and j
`1o
t
3
. Fig. 9. MBS coverage for different values of transmission and movement
range (step size). Every point on the graph is the average result of
50 simulations, whereas the vertical bars indicate the 95 percent
confidence interval.
Fig. 10. MBS coverage as a function of time. Every point on the graph is
the average result of 50 simulations, whereas the vertical bars indicate
the 95 percent confidence interval.
(that is, the speed and transmission range) needed to cover
a particular area in a particular amount of time.
Security and location privacy analysis of this protocol is
very similar to the one of the position verification protocol
presented in Section 4, and thus, we do not repeat it here.
6 LOCATION VERIFICATION IN MOBILE AD HOC
NETWORKS
In this section, we show how our node-centric position
verification protocols (Section 4) can be used for location
verification and secure location updates in mobile ad hoc
networks. The scenario presented in this section differs
from the scenario in Section 5 in that there are no dedicated
MBSs that move around and localize nodes. Instead, in this
scenario, nodes obtain their positions by using a global
positioning system (for example, the GPS [18]) and rely on
their neighbors for position verification. We further assume
that all nodes in the network have passive ranging
capabilities. We describe our protocols by assuming that
the nodes implement US-based passive ranging, although
other passive ranging scheme can be used (for example,
RSSI-based ranging).
6.1 Location Database Update
We consider a scenario in which a node wants to update its
location in a central location database. This update can be
motivated by a need to prove that the node was at a specific
location at a specific time (for example, to support secure
location-based routing). In order to update its location, the
node will rely on the (signed) statements of its neighbors.
In order to ensure the authenticity of these statements,
we assume that all nodes have a public/private key pair
and that each node shares a secret key with the location
database server. This scenario is illustrated in Fig. 11.
In order to update its location at the server, node
executes the protocol shown in Fig. 12. starts the protocol
by announcing its location on both the RF and US channels
with a signed broadcast message containing its location 1

and the time stamp T

. s neighbors (for example, 1)

verify s location claim and then issue a time-stamped and
signed statement :tot
1
regarding s claim. These state-
ments can be either positive (containing the string o/) or
negative (containing the string io/), stating that the
reported location 1

is correct or incorrect, respectively.

Here, 1
1o
is the secret key shared between 1 and the
server o. Note that does not know if 1s witness
statement is positive or negative. Upon verifying that the
statement originated in 1, forwards this confidential
message to the server o (possibly over multiple hops).
Alternatively, 1 can directly report its statement to the
server. s location 1

is therefore disclosed only to the

location server o and to its surrounding nodes (for location
verification purposes). The location server collects state-
ments about node locations and checks if the nodes
claimed locations and the location statements of their
neighbors match. The information collected at the server
can then be used by the network nodes, for example, for
secure location-based routing, and by the server, for
example, for the detection of malicious or selfish node
behavior. We note that before each location verification, a
node 1 needs to estimate if its position is sufficiently
unpredictable for the prover . Thus, 1 can do locally by
monitoring how much it moved since its last transmission.
6.2 Security Analysis
An attacker that wants to falsify its location must make the
distance calculated at the receiver match the position that
the attacker reports. We analyze this in detail in Section 7.
However, one point is of special significance in the case of
mobile ad hoc networks: since nodes mutually verify each
others locations, they will equally, by transmissions or by
explicit disclosure (for verification purposes), disclose their
locations. If an attacker therefore listens to the communica-
tion between the claimant node and its witnesses, it will at
least observe the location of the claimant and, at most, the
locations of its verifiers. If the attacker then initiates the
verification of its own location right after, it can successfully
cheat on its location, since it knows the locations of all its
neighbors. To prevent such attacks, nodes monitor how
much they moved since their last transmission or how
much time elapsed since their last transmission. Only if they
moved significantly and/or enough time has passed since
their last transmission will the nodes engage in a location
verification protocol as witnesses. As we have discussed
476 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 4, APRIL 2008
Fig. 11. Node gathers signed witness statements about its location in
order to update a central location database (residing on the server o).
Each using the protocol in Fig. 12, nodes 1, C, and 1 first verify the
location of (steps 1, 2, and 3) and then send (to ) signed statements
about their locations. then sends its position, along with the collected
witness statements (positive and negative), in a confidential message to
the server (step 4).
Fig. 12. Node 1 issues a witness location statement, attesting if was
at location 1

at time T
1
. Note that does not know if 1s witness
statement is positive o/ or negative io/. forwards this statement to the
server o (in a private message and possibly over multiple hops). s
location 1

is therefore disclosed only to its surrounding nodes

(for location verification) and to the location server o and is not
disclosed to other network nodes.
above, the proposed protocol preserves a nodes privacy
from all nodes, except from their neighbors (that need to
know the nodes location in order to verify it).
7 ANALYSIS
In this section, we analyze the likelihood that an (internal)
attacker succeeds in cheating our secure position verification
schemes by guessing the locations of or the distances to the
CBSs. This probability will notably depend on the size of
attackers searchspace (whichdepends onbase stationpower
ranges) and on the precision of the localization system.
First, we focus on the position verification protocol
described in Section 4. We define the attackers success as
the event where the attacker reports a position j
1
different
from its true position j
1
6 j

and the CBS concludes that

j

j
1
. This event will be realized only if jd
c
1
d
i
1
j .
This essentially means that an attacker needs to guess the
distance to the CBS d

in order to engineer the signals such

that the CBS measures a d
i
1
equal to the distance to the
reported (fake) position d
c
1
. The probability of attacker
success is therefore
1jd
c
1
d
i
1
j

j
1
6 j

. 2
Inour analysis, we assume that the localizationtakes place on
a disk (2D) and in a ball (3D). The position of the hidden base
station and the reported position of the attacker are therefore
on a disk (or in the ball). We assume that the position of the
base station is uniformly chosen on the disk (in the ball).
Other geometries can be observed, but we have chosen
circles, as they best reflect the power ranges of the devices.
7.1 Attackers Average Success Probability
To compute the average probability of an attackers success,
we assume that the attacker and the hidden base station are
placed uniformly on a disk/ball. In this case, the probability
distribution function (pdf) of the distance between the
attacker and the hidden base station is given by [40]
1
1
d

d
4d
1
2
cos
1
d
21

2d
2
1
3

1
d
2
41
2
r
3
for a disk and by
1
1
d

d
3d
2
1
3

9d
3
41
4

3d
5
161
6
4
for a ball, where 1 is the radius of the disk/ball. 1
1
and 1
1
are shown in Fig. 13. The maximumvalues of these functions
are 1
1
d

0.841 0.809 and 1

1
d

1.051 0.942.
This means that when the attacker is trying to guess the
distance to the CBS dj

. j
C1o
, he will have the highest
chance of success if his guess is d

0.841 (for a disk). In

this case, the probability of attackers success will be
1
1.nii

Z
0.841
0.841
1
1
dd % 0.809 2

1
. 5
1
1.nii

Z
1.051
1.051
1
1
dd % 0.942 2

1
. 6
These approximations hold for ( 1. These results are
important, as they show that the probability of an attackers
success grows linearlywiththe localizationandrangingerror
and is inversely proportional to the radius of the region in
which the hidden base station is placed. This means that the
probability of the attackers success is inversely proportional
to the square root of the space in which localization is taking
place. To put it simply, the more precise the localization
and distance measurement is, and the larger the space is, the
more secure the position verification becomes.
The probability of the attackers success can be signifi-
cantly reduced if multiple CBSs are used for position
verification. In that case, the probability of attackers success
is simply
1
i
1.nii
% 0.809 2

1

i
. 7
1
i
1.nii
% 0.942 2

1

i
. 8
The probability of the attackers success in both disk and
ball can therefore be upperbounded by 1
i
nii
2

i
.
7.2 Attackers Maximum Success Probability
So far, we have assumed that the attackers position j

is
chosen uniformly, meaning that the position at which the
attacker is placed can be anywhere within the disk/ball.
Here, we observe for which position j

the attacker will

have the highest probability of success. We show that the
attacker has the highest probability of success 1ior if he
chooses his position j

at the center of the disk/ball and if

he chooses d
i
1
1 as his fake measured distance to
CBS. This probability is given as follows (for a disk):
1
1
d

d
d
2
1
2
.
1
1
d

d
d
2
d
2
1
2

4d
1
2
.
1ior
1
1
1
d

41
1
2
.
9

CAPKUN ET AL.: SECURE LOCATION VERIFICATION WITH HIDDEN AND MOBILE BASE STATIONS 477
Fig. 13. The pdf of the distance d
c
1
dj
1
. j
C1o
on a disk 1
1
and in a
ball 1
1
, when j
C1o
and j
1
are chosen uniformly over the disk and ball,
respectively.
Similarly, for the ball, we obtain that 1
1
d

1

61
2
2
3
1
3
. From this, it follows that the maximum
probability of the attackers success, given i CBSs, is
1ior
i
1

41
1
2

i
. 10
1ior
i
1

61
2
2
3
1
3
!
i
. 11
This analysis shows that in the worst case scenario, the
maximum probability of the attackers success is approxi-
mately 2.5 times (disk, 2D) and 3 times (ball, 3D) the
average probability of the attackers success (when i 1).
Intuitive proof. It is sufficient to observe that the set with
the highest number of points equidistant from a single
point j in a disk/ball is the set of points on a circle (sphere)
of radius R when j is at the center of a disk/ball.
7.3 Extending the Analysis to Time Difference of
Arrival
In the case of position verification using TDOA as described
in Section 3, there is one additional element that the attacker
must consider. If the attacker will fake his position in a
TDOA environment, he must also guess the direction in
which he needs to point his directional antenna in order to
send the delayed message to the correct base station. We
will look at the scenario in which the attacker has the highest
probability of success, which is the case when the attacker
positions himself at the center of the verification circle.
If the CBSs are randomly distributed across the verifica-
tion space, the probability of the attacker hitting the correct
CBS depends on the angle of his transmission cone. If the
angle 0 is 0 degree, the probability of hitting the correct base
station is also 0. If the angle is 0
ior
(that is, 360 degrees in
a full circle), then the probability of hitting the correct
CBS is 1. We can write the following relation between the
probability and angle:
1
/it

0
0
ior
0
ic|
. 12
where 0 is the absolute angle, and 0
ic|
is the relative angle of
the transmission cone (relative to the angle of the available
space).
Choosing a large transmission angle in order to increase
the probability of hitting the correct CBS has one undesired
consequence: it also increases the probability that the
attacker hits one of the other CBSs. In order to succeed in
his attack, the attacker must hit the correct base station and
not hit any of the remaining base stations.
The probability of not hitting other base stations is
given by
1
iti
1 0
ic|

i1
. 13
where i is the number of base stations (that is, a minimum
of three in 2D).
The best choice for the attacker is to pick the angle that
maximizes his chance to hit the desired CBS but at the same
time minimizes the risk of hitting anyone else, that is, the
maximum of 1
/it
1
iti
. It is straightforward to show that
the maximum of 1
/it
1
iti
is
1
i
.
In Fig. 14, 1
/it
1
iti
is plotted as a function of the relative
angle of the transmission cone for i f2. 3. 4. 6. 12g base
stations. If there are four CBS, we can see in Fig. 14 that the
attacker would pick a transmission cone width of 1/4 of the
guessing space or 0 90 degrees, giving a probability of
successfully guessing the direction of one of the CBS while at
the same time not hitting anyone else by 10.5 percent.
However, that is only the direction to one of the CBSs.
Now, the attacker must find the next CBS; however, his
guessing space is reduced from 360 degrees to 360 degrees
90 degrees 270 degrees, and the number of base stations is
reduced from 4 to 3. Because there are now only three base
stations, the attacker will chose an angle of 1/3 of the
remaining guessing space or 90 degrees. This gives a
probability of successfully guessing the direction of another
CBS while at the same time not hitting any of the other
stations by 14.8 percent. Now, the guessing space is further
reduced to 270 degrees 90 degrees 180 degrees, and the
number of base stations is 2. Choosing 0 90 degrees
(half the guessing space), the probability is 25 percent.
After this, there is only one CBS left, and we know that it is
in the last quarter of the original guessing space. The
combined probability of correctly aiming four directional
antennas at four CBSs without accidentally hitting any
wrong CBS is therefore
0.105 0.148 0.25 0.0039.
This example is illustrated in Fig. 15.
Following the above procedure, it is easy to see that the
combined probability of correctly aiming ` directional
antennas at ` CBSs without accidentally hitting any wrong
CBS can be written as
Y
`
i1
1
i
1
1
i

i1
. 14
where ` is the number of CBSs in the verification space.
It should be clarified that this probability only covers the
aiming of the antennas. If an attacker actually wants to
478 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 4, APRIL 2008
Fig. 14. The probability of successfully guessing the direction of one of
the CBSs while at the same time not hitting any of the other base
stations 1
/it
1
iti
. Note that the angle is relative to the size of the
guessing space.
cheat on a location in a TDOA environment, he must also
fake the distance to each of the CBSs. In the case of
four CBSs ` 4 and an acceptable error of 0.011, the
maximum probability of successfully falsifying a position is
1
:nccc::

Y
4
i1
1
i
1
1
i

i1

41
1
2

4
3.9 10
3
2.5 10
6
9.6 10
9
.
7.4 Further Reducing the Probability of Attackers
Success
The attackers success can be further reduced by increasing
the space in which the CBSs can be positioned. So far, we
have assumed that the region in which the device proves its
position (localization region) is the same as the region
within which the CBSs are positioned. However, the CBSs
can also be placed outside the localization region (around
the localization region). The maximal distance from the
CBSs to the localization region will depend on the power
range of the attackers device and on the receiver sensitivity
of the base stations. This is illustrated in Fig. 16. In this case,
the maximum probability of the attackers success is further
reduced from 1ior
1

41
1
2
and 1ior
1

61
2
2
3
1
3
to 1ior
0
1

41
0

1
02
and 1ior
0
1

61
0

2
2
3
1
03
, respec-
tively, as 1
0
1.
This example further shows that regardless of the size of
the localization region (which can be arbitrarily small), the
probability of the attackers success can be small if the
detection region is sufficiently large.
It should be noted for completeness that a sophisticated
attacker might try obtaining information about the location
of a mobile or CBS by using a radar-based system capable of
detecting antenna backscatter (that is, the energy that is
reradiated by a receiving antenna). However, this energy is
very weak compared to the original signal, and the radar
signature that it generates is not bigger than the signatures
from other small metal objects in the environment [8]. For
this reason, it would be difficult, if not impossible, for the
attacker to detect the presence and/or location of covert/
mobile nodes in most (for example, urban) environments.
7.5 Sensitivity
In this section, we analyze the frequency of false positives
and false negatives as a function of the expected localization
and ranging error . If the authority sets to 0, the
probability of the attackers success will be 0, but due to the
localization and ranging errors, the system will reject all
reported locations, even if the device is not faking its
position. In this case, the frequency of false positives will
therefore be 1. Similarly, if is set to
1
2
1 (1 being the radius
of the verification space), then the probability of the
attackers success will be 1 (the attacker will assume that
the CBS is
1
2
1 away, and
1
2
1 will then cover the entire
space). In that case, the false locations of the attacker will be
accepted every time, and the frequency of false negatives
will be 1. It is therefore important to set such that it
minimizes the false negatives and false positives. This
means that should be chosen as a minimum value that
properly reflects localization and ranging errors.
As we have already noted, CBSs accept the position of
the node if jd
c
1
d
i
1
j . There are two sources of error in
this system. The first error is the localization error ciioi
1
,
which is contained in the reported position j
1
. The second
error is the ranging error ciioi
1
, and it is contained in the
distance measurement of d
i
1
. The total error in jd
c
1
d
i
1
j is
therefore ciioi ciioi
1
ciioi
1
. If localization and ran-
ging errors are already known and if we can assume that
they are Gaussian ciioi
1
$ `0. o
2
1
and ciioi
1
$ `0. o
2
1
,
then the total error of jd
c
1
d
i
1
j is ciioi $ `0. o
2

o
2
1
o
2
1
. If the errors are non-Gaussian or even not
independent, then we assume that the joint distribution of
the ciioi can be obtained experimentally.
Without any loss of generality, we can express in
terms of o as follows:
/o. 15
where / is a positive real number, and o is the standard
deviation of ciioi o

o
1
o
1
p
for independent Gaussian
errors). In the case that the ciioi is Gaussian, the probability
that d
c
1
d
i
1
falls within the interval /o. /o is given by [34]
1/o < d
c
1
d
i
1
< /o
2

p
Z /

2
p
0
c
n
2
dn
erf
/

2
p

.
16
Here, interval /o. /o is called the confidence interval. The
frequency of false positives can then be computed as
1
11
1 1/o < d
c
1
d
i
1
< /o. 17

CAPKUN ET AL.: SECURE LOCATION VERIFICATION WITH HIDDEN AND MOBILE BASE STATIONS 479
Fig. 15. An example of an attacker guessing the directions to four CBSs
in such a way that a transmission to any of the CBSs would not be
received by any other CBS.
Fig. 16. Localization and detection region. If the base stations can be
positioned outside the localization zone, the probability of the attackers
success can be further decreased.
that is, as the probability that d
c
1
d
i
1
does not fall within
the interval /o. /o.
The frequency of false negatives is simply the probability
of the attackers success given by (in 2D)
1
1`

41
1
2

4/o1/o
1
2
. 18
For i CBSs, these probabilities are defined as follows:
The frequency of false positives is defined as the probability
that at least one of the CBSs rejects the reported position,
even if the position is correct. This probability is given by
1
i
11
1 1/o < d
c
1
d
i
1
< /o
i
. 19
Similarly, the frequency of false negatives for i CBSs is
defined as the probability that all the base stations accept
the reported position, even if this position is false. This
probability is given simply as a probability of the attackers
success for i CBSs:
1
i
1`

4/o1/o
1
2

i
. 20
Fig. 17 shows the frequency of false positives and false
negatives as a function sensitivity :. Here, : is defined as 1/.
Sensitivity : is thus inversely proportional to the expected
error and is a measure of how sensitive the position
verification is to errors. If : 1, the systemis very sensitive,
and localization and ranging errors will not be tolerated.
If : 0, the system tolerates any error. Consequently,
the frequencies of false positives and false negatives
depend on :.
Fig. 17 shows the frequencies of false positives and false
negatives for 5 and 10 CBSs and for o 0.0051 (0.5 percent
of 1) and o 0.011 (1 percent of 1). The emphasis in these
figures is on the crossover error rate. The crossover error
rate is the error rate at which the false-positive frequency is
equal to the frequency of false negatives. In these figures, we
observe, as expected, that with the increase in the number
of CBSs and with the reduction of the standard deviation of
the localization and ranging error o, the crossover error rate
can be significantly reduced. If the number of CBSs is i 5
and if o 0.011, the crossover error rate will be about
1 10
4
. This error rate is significantly reduced to approxi-
mately 1 10
9
if the o is reduced to 0.0051 and if the
number of CBSs is increased to i 10.
Even if the crossover error rate is a good indicator of
system performance, we emphasize that the security of the
system can be significantly improved if the system can
allow for a higher false-positive frequency. We show in
Fig. 18 the probability of false negatives (probability of the
attackers success) as a function of the number of CBSs,
given that the frequency of false positives is set to 1 percent.
This figure shows that withthe frequencyof false positives set
to 1 percent, the probability of the attackers success is
significantlylower thanthe crossover error rate. We therefore
observe that with five or more CBSs, the probability of
the attackers success is lower than 10
5
, with the standard
deviation of error smaller than 0.031.
480 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 4, APRIL 2008
Fig. 17. The frequency of false positives and false negatives, and a crossover error rate for (a) o 0.0051 and i 5, (b) o 0.0051 and i 10,
(c) o 0.011 and i 5, (d) o 0.011 and i 10. : 1/ is the sensitivity. /o is the tolerated localization and ranging error. o is the standard
deviation of the localization and ranging error. Note that the probability axis is logarithmic.
We can also observe that with localization systems that
exhibit high standard deviation of error (up to 30 percent or
the region radius R), the probability of attackers success
can still be significantly reduced by increasing the number
of CBSs. For example, with o 0.21 and 20 hidden stations,
the probability of the attackers success is only 2 10
6
.
7.6 Integration with Existing Localization Systems
A number of systems for localization and ranging of
wireless devices have already been proposed based on the
propagation of RF, ultrasound, and infrared signals. Most of
these systems can be adopted to work with CBSs. Here, we
present a short overview of the precision and area sizes of
existing localization and ranging systems, and we discuss
how they can be integrated with secure localization based
on CBSs.
If localization is based on GPS, the accuracy of the
localization will be in 95 percent of cases better than 1 m.
RF ToF techniques being developed for localization GSM
and CDMA position aim at providing accuracy of 50-100
and 10 m in the case of UL-TOA, GSM and AGPS, and
CDMA, respectively. Note here that these systems are
designed for area and cell sizes that can have radii of 500 m
(in highly dense urban areas) to 35 km (in the countryside).
Indoors, localization with Wi-Fi based on signal strength
measurements with location fingerprinting can achieve
localization accuracy of 2-3 m, whereas ultrasound-based
ranging and localization systems can be accurate down to a
few centimeters. Ultrawideband (UWB) time-of-flight based
systems work both indoors and outdoors [2]. Indoors, they
can achieve ranging precision better than 1 m for ranges of
up to 50 m and localization accuracy of up to 15 cm. The
outdoor accuracy of UWB localization and ranging systems
can be also very high, approximately 1 m for distances of up
to 2 km [16]. All the numbers presented in this paragraph
are rough approximations of accuracies of these systems:
each of these systems can perform better or worse if one or
more of the system parameters change.
Here, we use the term accuracy very loosely, as the
measures of accuracy vary from one system to another. For
example, if GPS localization is used for providing position
reference to a device and UWB ranging is used for position
verification, the standard deviation of the error can be
estimated at up to 4 m. Given that the range of UWB
localization can be up to 2 km than o < 0.0051. Indoors, if
ultrasound is used for localization and ultrasonic ranging is
for verification, we can assume the standard deviation of
error to be in the order of 20 centimeters and ranges up
to 20 m, meaning that o 0.011. As we have shown in
Figs. 17 and 18, the probability of the attackers success in
these scenarios will then be as low as 10
35
.
8 RELATED WORK
In the last decade, a number of indoor localization systems
were proposed based notably on infrared [50], US ToF [51],
[35], RF RSS [4], [20], [10], and RF ToF propagation
techniques [27], [15]. These localization techniques were
then extended and used for localization in sensor and ad
hoc networks [13], [7], [47], [33], [32], [44], [30], [14].
Recently, a number of secure distance and location
verification schemes have been proposed. Brands and
Chaum [6] proposed a distance-bounding protocol that
can be used to verify the proximity of two devices connected
by a wired link. Sastry et al. [43] proposed a new distance-
bounding protocol based on ultrasound and radio wireless
communication. In that work, the authors also propose
making use of multiple base stations to narrow down the
area in which the nodes lie. However, as the proposal is
based on ultrasound distance bounding, it can be used only
for the verification of nodes locations and only if external
nodes have no access to the area of interest. In [22], Hu et al.
propose a mechanism called packet leashes that aims at
preventing wormhole attacks by making use of the geo-
graphic location of the nodes (geographic leashes) or of
the transmission time of the packet between the nodes
(temporal leashes). Kuhn [25] proposed an asymmetric
security mechanism for navigation signals. That proposal
aims at securing systems like GPS [18].

Capkun and Hubaux
[48] propose a technique called verifiable multilateration
based on distance bounding, which enables a local infra-
structure to verify the locations of the nodes. They further
show how that technique can be extended for secure
localization of a network of sensors. Lazos et al. [26]
proposed a set of techniques for secure localization of a
network of sensors based on directional antennas and
distance bounding. Li et al. [28] propose statistical methods
for securing localization in wireless sensor networks.
Liu et al. [29] propose techniques for the detection of
malicious attacks against beacon-based location discovery in
sensor networks based on the consistency of received
beacons. Rasmussen et al. propose SecNav [37] that relies
on signal broadcasts using I-codes [9] to achieve secure
localization and time synchronization. Recently, a number
of proposals have been made to protect the anonymity
and location privacy of wireless devices [38], [19], [39], [42],
[23], [24].
9 CONCLUSION
In this work, we proposed a novel approach to secure
localization based on CBSs (hidden base stations and
MBSs). This approach enables secure localization with a
broad spectrum of localization techniquesultrasonic or
RFbased on the received signal strength or the time of
signal flight. We have demonstrated that this approach can
be easily integrated with several existing node-centric and

CAPKUN ET AL.: SECURE LOCATION VERIFICATION WITH HIDDEN AND MOBILE BASE STATIONS 481
Fig. 18. The frequency of false negatives (the probability of the
attackers success) if the frequency of false positives is set to 1 percent.
infrastructure-centric localization schemes. We have shown
how the security of this approach depends on the precision
of the localization systems and on the number of CBSs. Our
future work includes implementations of our schemes and
their evaluation in various indoor and outdoor scenarios.
We also intend to investigate in more detail the privacy
implications of our approach.
ACKNOWLEDGMENTS
The work presented in this paper was supported (in part)
by the Swiss National Science Foundation under Grant
200021-116444/1.
REFERENCES
[1] Amigobot, http://www.amigobot.com/, 2007.
[2] UWB Technology for Positioning, www.thalesresearch.com, 2007.
[3] C. Avin and C. Brito, Efficient and Robust Query Processing in
Dynamic Environments Using Random Walk Techniques, Proc.
Third Intl Symp. Information Processing in Sensor Networks (IPSN),
2004.
[4] P. Bahl and V.N. Padmanabhan, RADAR: An In-Building
RF-Based User Location and Tracking System, Proc. IEEE
INFOCOM 00, vol. 2, pp. 775-784, 2000.
[5] S. Bergbreiter and K.S.J. Pister, CotsBots: An Off-the-Shelf
Platform for Distributed Robotics, Proc. IEEE/RSJ Intl Conf.
Intelligent Robots and Systems (IROS), 2003.
[6] S. Brands and D. Chaum, Distance-Bounding Protocols,
Advances in CryptologyProc. Workshop Theory and Application
of Cryptographic Techniques (EUROCRYPT 94), pp. 344-359, 1994.
[7] N. Bulusu, J. Heidemann, and D. Estrin, GPS-Less Low-Cost
Outdoor Localization for Very Small Devices, IEEE Personal
Comm. Magazine, vol. 7, no. 5, pp. 28-34, Oct. 2000.
[8] W.F. Butler, Antenna Backscatter with Applications to Surgical
Countermeasures, Technical Report ADE001679, Defense
Technical Information Service, 1981.
[9] M. Cagalj, S. Capkun, R. Rengaswamy, I. Tsigkogiannis,
M. Srivastava, and J.P. Hubaux, Integrity (I) Codes:
Message Integrity Protection and Authentication over Insecure
Channels, Proc. IEEE Symp. Security and Privacy (S&P), 2006.
[10] P. Castro, P. Chiu, T. Kremenek, and R. Muntz, A Probabilistic
Room Location Service for Wireless Networked Environments,
Proc. Third Intl Conf. Ubiquitous Computing (UbiComp 01),
vol. 2201, Sept. 2001.
[11] H. Chan, M. Luk, and A. Perrig, Using Clustering Information
for Sensor Network Localization, Proc. First IEEE Conf. Distributed
Computing in Sensor Systems (DCOSS 05), June 2005.
[12] K. Dantu, M.H. Rahimi, H. Shah, S. Babel, A. Dhariwal, and
G. Sukhatme, Robomote: Enabling Mobility in Sensor Net-
works, Proc. Fourth Intl Conf. Information Processing in Sensor
Networks (IPSN), 2005.
[13] L. Doherty, K. Pister, and L. El Ghaoui, Convex Position
Estimation in Wireless Sensor Networks, Proc. IEEE
INFOCOM 01, Apr. 2001.
[14] T. Eren, D. Goldenberg, W. Whiteley, Y.R. Yang, A.S. Morse,
B.D.O. Anderson, and P.N. Belhumeur, Rigidity, Computation,
and Randomization in Network Localization, Proc. IEEE
INFOCOM, 2004.
[15] R.J. Fontana, Experimental Results from an Ultra Wideband
Precision Geolocation System, Ultra-Wideband, Short-Pulse
Electromagnetics, May 2000.
[16] R.J. Fontana, E. Richley, and J. Barney, Commercialization of an
Ultra Wideband Precision Asset Location System, Proc. Second
IEEE Conf. Ultra Wideband Systems and Technologies (UWBST 03),
Nov. 2003.
[17] J. Friedman, D. Lee, I. Tsigkogiannis, S. Wang, D. Chao, D. Levin,
M. Srivastava, and W. Kaiser, Ragobot: A New Hardware
Platform for Research in Wireless Mobile Sensor Networks, Proc.
First IEEE Intl Conf. Distributed Computing in Sensor Systems
(DCOSS), 2005.
[18] I. Getting, The Global Positioning System, IEEE Spectrum,
Dec. 1993.
[19] M. Gruteser and D. Grunwald, Enhancing Location Privacy in
Wireless LAN through Disposable Interface Identifiers: A Quan-
titative Analysis, Proc. First ACM Intl Workshop Wireless Mobile
Applications and Services on WLAN Hotspots (WMASH), 2003.
[20] J. Hightower, G. Boriello, and R. Want, SpotON: An Indoor 3D
Location Sensing Technology Based on RF Signal Strength,
Technical Report 2000-02-02, Univ. of Washington, 2000.
[21] L. Hu and D. Evans, Localization for Mobile Sensor Networks,
Proc. ACM/IEEE MobiCom, 2004.
[22] Y.-C. Hu, A. Perrig, and D.B. Johnson, Packet Leashes: A Defense
against Wormhole Attacks in Wireless Networks, Proc. IEEE
INFOCOM 03, Apr. 2003.
[23] L. Huang, K. Matsuura, H. Yamane, and K. Sezaki, Enhancing
Wireless Location Privacy Using Silent Period, Proc. IEEE
Wireless Comm. and Networking Conf. (WCNC), 2005.
[24] J. Kong and X. Hong, ANODR: ANonymous On-Demand
Routing with Untraceable Routes for Mobile Ad Hoc Networks,
Proc. ACM MobiHoc, 2003.
[25] M.G. Kuhn, An Asymmetric Security Mechanism for Navigation
Signals, Proc. Sixth Information Hiding Workshop (IH), 2004.
[26] L. Lazos, S.

Capkun, and R. Poovendran, ROPE: Robust Position
Estimation in Wireless Sensor Networks, Proc. Fourth Intl Symp.
Information Processing in Sensor Networks (IPSN), 2005.
[27] J.-Y. Lee and R.A. Scholtz, Ranging in a Dense Multipath
Environment Using an UWB Radio Link, IEEE J. Selected Areas in
Comm., vol. 20, no. 9, Dec. 2002.
[28] Z. Li, W. Trappe, Y. Zhang, and B. Nath, Robust Statistical
Methods for Securing Wireless Localization in Sensor Networks,
Proc. Fourth Intl Conf. Information Processing in Sensor Networks
(IPSN), 2005.
[29] D. Liu, P. Ning, and W. Du, Attack-Resistant Location Estimation
in Sensor Networks, Proc. Fourth Intl Conf. Information Processing
in Sensor Networks (IPSN), 2005.
[30] D. Moore, J. Leonard, D. Rus, and S. Teller, Robust Distributed
Network Localization with Noisy Range Measurements, Proc.
Second ACM Conf. Embedded Networked Sensor Systems (SenSys 04),
pp. 50-61, 2004.
[31] L. Navarro-Serment, R. Grabowski, C. Paredis, and P.K. Khosla,
Modularity in Small Distributed Robots, Proc. SPIE Conf. Sensor
Fusion and Decentralized Control in Robotic Systems II, 1999.
[32] D. Niculescu and B. Nath, Ad Hoc Positioning System (APS)
Using AOA, Proc. IEEE INFOCOM 03, Apr. 2003.
[33] D. Niculescu and B. Nath, DV-Based Positioning in Ad Hoc
Networks, J. Telecomm. Systems, vol. 22, no. 4, pp. 267-280, 2003.
[34] V. Van Nostrand, Mathematics of Statistics, 1962.
[35] N.B. Priyantha, A. Chakraborty, and H. Balakrishnan, The
Cricket Location-Support System, Proc. ACM/IEEE MobiCom 00,
pp. 32-43, 2000.
[36] K. Rasmussen and S. Capkun, Implications of Radio Fingerprint-
ing on the Security of Sensor Networks, Proc. Third IEEE Intl
Conf. Security and Privacy for Comm. Networks (SecureComm), 2007.
[37] K. Rasmussen, S. Capkun, and M. Cagalj, SecNav: Secure
Broadcast Localization and Time Synchronization in Wireless
Networks, Proc. ACM MobiCom 07, pp. 310-313, 2007.
[38] A.R. Beresford and F. Stajano, Location Privacy in Pervasive
Computing, Pervasive Computing, Jan.-Mar. 2003.
[39] I.W. Jackson, Anonymous Addresses and Confidentiality of
Location, Proc. First Intl Workshop Information Hiding (IH), 1996.
[40] M.G. Kendall and P.A.P. Moran, Geometrical Probability. Hafner,
1963.
[41] R.C. Shah, S. Roy, S. Jain, and W. Brunette, Data MULEs:
Modeling a Three-tier Architecture for Sparse Sensor Networks,
Proc. First IEEE Workshop Sensor Network Protocols and Applications
(SNPA 03), May 2003.
[42] Y.-C. Hu and H.J. Wang, Location Privacy in Wireless
Networks, Proc. ACM SIGCOMM, 2005.
[43] N. Sastry, U. Shankar, and D. Wagner, Secure Verification of
Location Claims, Proc. ACM Workshop Wireless Security (WiSe 03),
pp. 1-10, Sept. 2003.
[44] A. Savvides, C.-C. Han, and M.B. Strivastava, Dynamic
Fine-Grained Localization in Ad Hoc Networks of Sensors,
Proc. ACM/IEEE MobiCom 01, pp. 166-179, 2001.
[45] S. Sedihpour, S. Capkun, S. Ganeriwal, and M. Srivastava,
Implementation of Attacks on Ultrasonic Ranging Systems,
Proc. Third ACM Intl Conf. Embedded Networked Sensor Systems
(Sensys), 2005.
482 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 4, APRIL 2008
[46] S.

Capkun, L. Buttyan, and J.-P. Hubaux, SECTOR: Secure
Tracking of Node Encounters in Multihop Wireless Networks,
Proc. First ACM Workshop Security of Ad Hoc and Sensor Networks
(SASN 03), Oct. 2003.
[47] S.

Capkun, M. Hamdi, and J.-P. Hubaux, GPS-Free Positioning
in Mobile Ad Hoc Networks, Cluster Computing, vol. 5, no. 2,
Apr. 2002.
[48] S.

Capkun and J.-P. Hubaux, Secure Positioning of Wireless
Devices with Application to Sensor Networks, Proc. IEEE
INFOCOM, 2005.
[49] S.

Capkun, J.-P. Hubaux, and L. Buttyan, Mobility Helps Peer-to-
Peer Security, IEEE Trans. Mobile Computing, Jan. 2005.
[50] R. Want, A. Hopper, V. Falcao, and J. Gibbons, The Active Badge
Location System, ACM Trans. Information Systems, vol. 10, no. 1,
pp. 91-102, 1992.
[51] A. Ward, A. Jones, and A. Hopper, A New Location Technique
for the Active Office, IEEE Personal Comm., vol. 4, no. 5, Oct. 1997.
Srdjan

Capkun received the DiplIng degree in
electrical engineering and computer science
from the University of Split, Croatia, in 1998
and the PhD degree in communication systems
from the Swiss Federal Institute of Technology
of Lausanne (EPFL) in 2004. He is currently an
assistant professor in the Department of Com-
puter Science, ETH Zurich. Prior to joining ETH
Zurich, he was a postdoctoral researcher in the
Networked and Embedded Systems Laboratory
(NESL), University of California, Los Angeles, and an assistant
professor in the Informatics and Mathematical Modeling Department,
Technical University of Denmark (IMM DTU). His research interests
include the design and analysis of security protocols for wireless and
wireline networks. He is a member of the IEEE and the IEEE Computer
Society.
Kasper Bonne Rasmussen received the MSc
degree in information technology and mathe-
matics from the Technical University of Denmark
in 2005. He is currently working toward the PhD
degree with the System Security Group, Depart-
ment of Computer Science, ETH Zurich. His
PhD research focuses on the security of wireless
networks, with a special interest in location and
time synchronization issues. He is a member of
the IEEE.
Mario

Cagalj received the DiplIng degree in
computer science and electrical engineering
from the University of Split, Croatia, in 1998
and the predoctoral and PhD degrees in com-
munication systems from the Ecole Polytechni-
que Fe de rale de Lausanne (EPFL) in 2001 and
February 2006, respectively. From 2001 to 2006,
he was a research assistant in the Laboratory for
Computer Communications and Applications
(LCA), EPFL. In January 2006, he joined the
Faculty of Electrical Engineering, Mechanical Engineering, and Naval
Architecture (FESB), University of Split, where he is currently an
assistant professor in the Department of Electronics. His research
interests include the design and analysis of security protocols for wireless
and wired networks, the application of game theory to communication
networks, and the design of energy-efficient communication protocols for
wireless networks. He is a member of the IEEE.
Mani Srivastava received the BTech degree in
electrical engineering from IIT, Kanpur, India, in
1985 and the MS and PhD degrees from the
University of California, Berkeley. His graduate
work was focused on CAD tools for embedded
DSP VLSI and system designs. His MS project
was focused on CMOS bit-slice data path
compilation as part of the Lager silicon compiler
for DSP VLSI, whereas his PhD dissertation was
focused on hardware-software rapid prototyping
and codesign at the board level for embedded DSP and control
applications. In 1997, he joined the faculty of UCLA, where he is
currently a professor and the vice chair of graduate affairs in the
Electrical Engineering Department, with a joint appointment as a
professor in the Computer Science Department. Before joining UCLA,
for about four and a half years, he was with the Networked Computing
Research Department, Bell Laboratories, Murray Hill, N.J. (formerly
known as AT&T Bell Laboratories and later named Lucent Technologies-
Bell Labs Innovations), where his group built one of the first wireless
ATM systems. He is currently the editor in chief of the ACM Mobile
Computing and Communications Review and an associate editor for the
ACM Transactions on Sensor Networks and the ACM/IEEE Transac-
tions on Networking. His research interests include mobile and wireless
systems. He is a member of the IEEE.
> For more information on this or any other computing topic,
please visit our Digital Library at www.computer.org/publications/dlib.

CAPKUN ET AL.: SECURE LOCATION VERIFICATION WITH HIDDEN AND MOBILE BASE STATIONS 483